ntdll.dll access violation error


we did an in-place upgrade of a windows 2003 server to windows 2008 server. After the upgrade, couple of windows services stopped working. The error i am getting in the event viewer looks like this:

Faulting application someservice.exe, version, time stamp 0x38f21f27, faulting module ntdll.dll, version 6.0.6002.19346, time stamp 0x55024174, exception code 0xc0000005, fault offset 0x00066439, process id 0x10e8, application start time 0x01d0afd9a7dee788.

What this application does is, it reads a text file and parses the output.

In the application log, i can see it got to the file but before it can read, it crashed. I do not have source code for this application. May be it fails to open the file.

This application works fine on Windows 2003 Server.

I tried to create dump files but it did not generate any.

When i run "cmd" from Run menu and try to run chkdsk or scandisk, it throws me an error saying these commands requires DOS 6.0 or higher. But when i open Command.com from C:\Windows\System32 folder and run these commands, they work just fine.

I ran chkdsk, scandisk, sfc but none of this options have helped me fix the issue.

I am running this on Windows Server 2008 SP2 with all the Windows Updates installed.

Any help/pointers will be highly appreciated.

More details:

When i run "cmd" from the Run prompt, it shows C:\Users\User0000004. For 2003 servers, it used to show C:\Users\<myloginusername>. When i checked c:\users folder, all the folders that should have previously logged in user names were renamed to User000001, User0000002, User0000003 etc.

asked on Server Fault Jun 26, 2015 by Asdfg • edited Jun 28, 2015 by Asdfg

1 Answer


Dumb Question #1: Have you turned off UAC?

More often than not this causes issues with applications that "Worked fine in 2003".

Dumb Question #2: Have you tried ProcMon to figure out why it's crashing?

"May be it fails to open the file.": I think you nailed it here (either file or port related would be my guess), procmon will help you verify the issue. Setup the filter by process name, then look for ACCESS_DENIED or other similar errors while trying to execute the application.

Download procmon (it's free, and supported by Microsoft)

answered on Server Fault Jul 3, 2015 by Joseph Kern

User contributions licensed under CC BY-SA 3.0